(security) golang: bump Go version to 1.25.3-1

[bot-for-go]

Hi! 👋 I'm the Microsoft team's bot. This is an automated pull request I generated to bump the Go version to 1.25.3-1.

This update contains security fixes.

I'm not able to run the Azure Linux pipelines yet, so the Microsoft release runner will need to finalize this PR. @dagood

Finalization steps:

• Trigger Source Tarball Publishing with:
  Full Name:

  go1.25.3-20251013.2.src.tar.gz
  

  URL:

  https://github.com/microsoft/go/releases/download/v1.25.3-1/go1.25.3-20251013.2.src.tar.gz
  

• Trigger the Buddy Build with:
  First field:

  PR-14863
  

  Core spec:

  golang
  

• Post a PR comment with the URL of the triggered Buddy Build.
• Mark this draft PR as ready for review.

Thanks!

[dagood]

Buddy build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=953807&view=results

[mfrw]

changes lgtm

the buddy build is broken.
Trying to verify if this is an actual concern.

Thanks @dagood

[PawelWMS]

changes lgtm

the buddy build is broken. Trying to verify if this is an actual concern.

Thanks @dagood

@mfrw, you can try running the ADO pipeline PR checks. I started one below. They are required for these PRs anyway and simulate the production build configuration better than buddy builds. They don't run package install checks, unfortunately.

[PawelWMS]

/azurepipelines run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[anphel31]

/azurepipelines run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[anphel31]

/azurepipelines run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[anphel31]

Full pipeline builds to validate packages dependent on golang: x64 arm64

[CBL-Mariner-Bot]

Auto cherry-pick results:

• 3.0-dev ✅ -> [AUTO-CHERRYPICK] (security) golang: bump Go version to 1.25.3-1 - branch 3.0-dev #14897

Auto cherry-pick pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=957871&view=results